The vulnerable ElementsKit Pro plugin exposes a REST endpoint that accepts the ‘s’ search term without proper escaping. Though sanitize_text_field() is called, it fails to encode double quotes. The supplied value is later rendered inside an HTML attribute via sprintf, bypassing esc_attr(), and stored in the ekit_advanced_search_popular_keyword option. An attacker can therefore persist malicious code that is executed whenever a user triggers the no‑results popular‑keywords view in a page that includes the Advanced Search widget. This enables script payloads that can steal cookies, hijack sessions, or modify page content, impacting confidentiality, integrity, and availability of the site. The vulnerability is a typical example of CWE‑79: Improper Neutralization of Input During Web Page Generation.

ElementsKit Pro for WordPress, version 4.10.1 and earlier, all installations that enable the Advanced Search widget. The flaw exists in the /wp-json/elementskit/v1/advanced-search REST endpoint where permission_callback is set to __return_true, allowing any unauthenticated user to submit search terms. Sites using older ElementsKit Pro versions should be reviewed for deployment of the plugin.

The CVSS base score is 6.1, indicating medium severity. The EPSS score is <1%, and the issue is not listed in the CISA KEV catalog. The flaw is exploitable without authentication via the public REST API; the attacker only needs to send a crafted request containing an XSS payload. Once stored, the malicious content will be displayed to any visitor who activates the populated keyword view, giving the exploit a wide attack surface across the entire site. The straightforward attack path and lack of privileged prerequisites make this a realistic threat for sites running affected plugin versions.